Analysis
-
max time kernel
118s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 16:20
Static task
static1
Behavioral task
behavioral1
Sample
46ffb9d6823a9a11bb8b67bd544cff79_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
46ffb9d6823a9a11bb8b67bd544cff79_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
46ffb9d6823a9a11bb8b67bd544cff79_JaffaCakes118.html
-
Size
136KB
-
MD5
46ffb9d6823a9a11bb8b67bd544cff79
-
SHA1
3dd58219b5bdcbce3834128ec04b1c4780d76442
-
SHA256
75eb04d0c4e3ea20f66955f7146574602d23e61fa4bc63bddf1cc50e772b26d8
-
SHA512
3fac63f30327f4cb70c3f215996afe2b89c6669664437be770a856487630cb4e4b1622dfcb6b10183d434feca3810811db978c0a4d71ea705bbe88f39299b0ae
-
SSDEEP
1536:SiRniZ5yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:SgiZ5yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09384f3e3a6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EA74CE1-12D7-11EF-8E9F-FAB46556C0ED} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000000c05c2dd939a45fbf04bf0de413179c4c22fe3eca0b4fbd9d95a1e74527abc7000000000e800000000200002000000080afdfe5596fd9e820f93b6609772dd29f622ce4eeed153e84db721c56e9bb432000000087424dbdfc4f9a5092192be61322f84b8f5ab3d3f4b5b4e7053203b9ffc9a2e440000000ab6f5f575b148245e9cd9206e3023d860e46295480920b4cfabcf654665bc4dbd6fcd6845796c25f174985bd2232dc523589f75cb6290808a07665daa68dfbb3 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000004232ed0d1f111cf9cf14a39a87f34b59f3cee4dd7333d7b393546e40d64b0347000000000e80000000020000200000002a9228a6321911f6e1bc47dc55a78042f4fc0536885c03e8629f3f9ea72831a6900000000d4fc4dff984681f07946ecb000a8d9a277e5509c77e3e392f97adc3a2241a433bc86ed162bba26adb56f2009f86dc2ed0b34c338abd485fc8001cc92533f17d05474d3c1f18db009438ddcdf9f8bc9b65170561d0e8f3b95c1ca60ecb4d59d31d5618cf4a07e3da6e5f607b95d5ac9dd0ac968b9dcaf81ea11e51ed2ef9360474a2a759baec9b0e792271a21ab3c4644000000048a5c58368ce1a35f3e9950527ff97f61036e698e697c11147920f2641c551f535eb90d5117c05ebe32c40530a49ba91466fd1c4f82cccfe8fa66597547688a1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421951929" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2980 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2980 iexplore.exe 2980 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2916 2980 iexplore.exe 28 PID 2980 wrote to memory of 2916 2980 iexplore.exe 28 PID 2980 wrote to memory of 2916 2980 iexplore.exe 28 PID 2980 wrote to memory of 2916 2980 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46ffb9d6823a9a11bb8b67bd544cff79_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5de34e8462d71cf6f92e78befb11312
SHA1ba2851d4c612b931ef84dcf126e3f519696e14b5
SHA256c3625f45b82fc5ab0517de5b5357a4ef2b201fd9cf219972af3b0dd9dc074c21
SHA51240c46c07356000de15862f5e85d9ba08901576b1a6d5cc5f5a51a4c48a886e943d40c3809e2b15c94333512841038e906bb4c00c5b0a78afd50420db52b5dd37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583e6d282b8c22a188a9f82db9191d61b
SHA19dc6900f89fa634b18d60730cbbc494ca868f36f
SHA256d3fef157152f0b01002ef8dd43bb76bc80316687a1e56f831c010cb6a2577a87
SHA51271e49acde4478710b8e584878c6147ab6d1fbab392034efaf2abf4cc91b67a9c662a7aa17f2d16b9e11a72f660278bbea47a427a07c7ea77c720ff3a16c859fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503df55ae591142a6c40fef2ebf5a8844
SHA171cddc56ff917b2d098efedede6e34e0322b170d
SHA25642e8e0649e56297672609405a1175c7dbba92d3d06938cb343ba1eebabcbad8a
SHA51264db6276814f91b27d832fcf60462f1ded1862fa5dd5f1e8d5d6c11e58ba0f61b4801152bcb65e144d7b936b1edb5bed221d94643788782bd0534b23d187005c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579c6c1f481f173a88e974915e65f9c33
SHA1ce3f50d1fe033bcb64a60a95e55d6796a5c23dd2
SHA2569978a675bd3e9f183c2c3fa592e4b99e7d9e78a01e1156b5bb5540dc9f808764
SHA51252b6365f7821aafe4252f6e34b2bdd8265fd5388cb4a26fae4ae20e4a993f45ffbdaf98db8db51df08097c6923cab68a2810e9c3f85dd2384b66c73d0134aca8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5daf926f1ad71df8dc24424058fc0117e
SHA1181cbf22a3919bc793c4ab6a4aba98f8bb12a48e
SHA256dd959ac82919b46cd18cc7c81eb135bb26dc2aab7ff8f81974fd78f48916fd5c
SHA51228545da71ace03658fd0421b3c7a2f0e06aafab7e005a35146f5dd771eaca8f5c547db815a8267a138880965b2a3fd0c390a391b0a1df4d5cefc20f2e06b836a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b31da36d9328ad35e24ab411ec264cc
SHA14a1129d9bef75f915ada91ca6eb0b39a99f62acc
SHA25601c330fd5982bfbc8ad1b878d7e212c0b5ca9bda1029018f467d8834c44f4d3b
SHA512f3093b1c04718868981a8563933f0c4f2cfdeab11ad25f8ed1e5088f484a76597f12d588c010353af8de8beb0dbaa32053eff6936a27bb62fbbab738a4574ce0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5445879c99bb50bcd7071c42442ca8172
SHA1db9c873f4861deb6f34bb13944e7a808462d6b53
SHA2568ce42637958588eb01f0e32bd305e1cee805502a571e71b0860e2e480833fd01
SHA512b61c6afd7f34c873289607598fc7aeae6e0a5a27d7dacebb73b2d93200922f29df588a496a83bc18b8b0d4b97f4f19649db2200cbdb68cdc47628c2e6591b539
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574478d6d7c491da73602059adb1bc641
SHA191298828a4e9dfb76e2eee9ebd41af4daf396c39
SHA256e30c9bb6390dca10980c9d4ece6f852c54dbd227521fa9236f030c3bc23e1968
SHA51294b9a9824771ce69c8416458897c74ef3ccc420709b42bbd9999dfb29b267609376ed0c06eab0b9dae84ebbb813a2fea26b0c64f088145785e0563d36f48ddd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9156fa1fd048a4916f81f8581ea7b0a
SHA12d2e5bcabd76441aa44b8ae8bf540a9183760a50
SHA256ff20ba854ed2f225528efb833d6dfe288abbd42d70b01d8091cf5b42f3433dd6
SHA51259f5e69da3355f2f864afeb72a2d19d09d5213b3f8db0f793ba7ab6e3bdc93b85ea985641abb37be1be302fa197bf1cae525848e5ea42159eede3a4ad0e9345b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5702a7ecb60c30958803f5d1b1bb9a84e
SHA1ab68402b0b53726afd2875b70335406cc4474f3b
SHA256ce8f08e0c589e6b67b59e54a167607b107bf7be7e42df84071dc62e0076039fd
SHA512f360d3de0947ee2ee2eb97411905aff1e439b999000d47191bc5e64bd24e47d8d8e7d5ee16a8e6be057bbfbf4296f8bef64207a622c4d99d4e015b233c5ffc0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5952bca6e6fdf49fdb042a630581a3949
SHA1534b2a473ca11c3d57e1369aa8152bf3d006813c
SHA2566d42401acfca5d8469c1d56867d406f6d553f6dfdfba9cc03aa2fbf3c2e40e89
SHA512a373a1601a2ae044f76b66aaa817c69b0755581c7b1d6990b5e24f90de608da6455a13c2c7575037d880c72b2284b1b9fa9b7ccb42e867e55b61b712e1fac0a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd735b26560eae37037d76f611690e13
SHA1ec9579c14b1862bf80b66505736b1450f3e3cfdd
SHA256fa85da643e795eebeb5ae69fba025515f2a3624aa2aa035adaa4a1feee0678a3
SHA5125afce1155d614b264bba9b12cf41fc3598b042cdd970668fe62e7a7b605837bae32f6264394991d5bf30d24d7528e566e796b6382f06b7774f997ce4c165a14d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8c943d4367b75d57324b4f4e9e2c9a3
SHA1245ac09d25f328e0f5df927490a312433514704e
SHA256745cdac76eba66999dd02ff165ef7e6b32d31c2ad9eb1f1a7a8d966c92312163
SHA51273aacaa4d59c8ff89b34a7b05b19b286cf837d972a43ff766a29138b08d41e59e9b1b5f6ce3b85ef569b68733cfa80175c1f64098fa2cae612526cd38e3a254c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5ede747b0212c5c20e76e16e58d6f4e
SHA1a11fdd67b20a855c2259c2192d290b0fdcae17ba
SHA256efcfa3161fe5e7aa8f43d8db13a538ae43286904502ea198ab627b9a9d6e64e2
SHA512a045bdfa805e93498e759ed794152773c1c3d5a48910ae536b8d010611dd1ad7365f7feef132aef48e212439df6df15d1c66683d9bbe65c4c2fbf97b9415d619
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b32334b74488815e9e461ec0dcd48281
SHA156b9633771ba69b3b6a0bd50cf8454246731337a
SHA256f009962378f2280e2cf5b1f0257cdcf1a10c6975e70d09c79abadb7107c27792
SHA512bda11faa181cc80b797a3c4be49c1af3fd44e770cbdd5b48239c0636ae8a21452fb6038058f04a236487aacafbccabf2a7c73bc03df37102773fa9a770e60ad1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5902086e6be0f45a725b6e3e413d9e114
SHA12b4db75cb2685f1f6df2150943302446b77f7dc5
SHA2561ad4b794f54bbf7edfc5660b8adfb0c8ef3137f79067a4daf42df75e4ff6c55b
SHA512060ac9ce99248574f4b6cd8e2471c986e18b8a7f3784e24d3794eefae46c68194f71e0b549e8e235735c4cf10cb5bcd4caa32ca8a10338e270b7b4b5ea1fd3c2
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a